What is the CVSS score of CVE-2026-60527?

CVE-2026-60527 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60527?

Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0 contain a data access vulnerability allowing attackers with local infrastructure access to read sensitive business information and…

How to fix or mitigate CVE-2026-60527?

Within 24 hours, identify all systems running Oracle WebLogic Server versions 14.1.2.0.0 or 15.1.1.0.0. Within 7 days, apply the Oracle Critical Patch Update (July 2026) to all affected systems. Within 30 days, verify patching completion and validate that local access controls have been properly enforced.

Oracle WebLogic Server CVE-2026-60527

EUVD-2026-46889 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-c9jp-cw45-rgmv

Authentication Bypass Oracle Weblogic Server

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.1 HIGH

Requires local logon to the host but no WebLogic credentials (AV:L, PR:N); scope change plus high confidentiality-only impact (S:C, C:H, I:N, A:N) matches an auth-bypass data-exposure flaw.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:09 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows an attacker with local logon to the hosting infrastructure to compromise the server and read all WebLogic-accessible data, with a scope change that can significantly impact other collocated products. Oracle rates it CVSS 3.1 7.1 (confidentiality-only). This is addressed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw resides in the WebLogic Server administration Console, the web-based management interface for Oracle Fusion Middleware application servers. Oracle's own tagging labels this an Authentication Bypass, and the CVSS metrics (AV:L, PR:N) describe an attacker who already has an interactive logon to the host running WebLogic but who does not need valid WebLogic credentials - consistent with a bypass of Console-level authentication or authorization controls. No CWE was assigned by NVD (CWE: N/A), so the precise weakness class (e.g., improper authentication vs. access control) cannot be confirmed from the supplied data; the confidentiality-only impact (C:H, I:N, A:N) indicates the defect exposes data rather than permitting modification or denial of service.

RemediationAI

Apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to the affected WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 installations - Patch available per vendor advisory (Oracle CPU July 2026); an exact patched build string was not included in the input, so consult the CPU patch matrix for the precise interim/PSU number for your version. As compensating controls until patching, tightly restrict interactive/OS logon on WebLogic hosts to trusted administrators only (the vulnerability requires local logon to the infrastructure), and restrict network and host access to the administration Console - for example bind the Console to a management-only interface, place it behind a firewall or restrict its port to admin subnets, or disable the Console (setEnable(false) via WLST/weblogic.management.remote) where it is not operationally required, accepting the trade-off that browser-based administration is then unavailable and must be performed via WLST/scripts. Monitor Console access and authentication logs for anomalies.